Check ID: identity_user_api_keys_rotated_90_days
Provider: Oracle Cloud (OCI)
Service: identity
Severity: MEDIUM
Categories: identity-access, secrets
Resource type: User

​
What this check verifies

OCI IAM users with active API signing keys older than 90 days are identified. Key age is derived from each key’s creation time; only active keys are considered. Users without API keys are recorded.

​
Risk

Long-lived API keys widen exposure. If a key leaks, an attacker can sign OCI API calls without MFA, enabling unauthorized changes (integrity), data access (confidentiality), and service outages (availability). Delayed rotation prolongs dwell time and complicates incident response.

​
Recommendation

Enforce API key rotation every 90 days.
  • Issue a new key, confirm workloads use it, then revoke the old key
  • Apply least privilege and avoid shared keys
  • Limit active keys per user and remove unused ones
  • Monitor usage and automate rotation for defense in depth

​
Remediation

oci iam api-key delete —user-id <user-ocid> —fingerprint <old-key-fingerprint> —force

​
References

​
Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = identity_user_api_keys_rotated_90_days. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Oracle Cloud (OCI) checks